CVE-2019-6109
Medium
Description
An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server (or Man-in-The-Middle attacker) can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This affects refresh_progress_meter() in progressmeter.c.
SeverityMedium
CVSS6.8
Exploit probability—
Product
Openbsd Openssh
PublishedJan 31, 2019
First seenJan 31, 2019
Weakness typeCWE-116CWE-116
How to fix
Update
- siemens scalance_x204rna_firmware3.2.7 or later
- siemens scalance_x204rna_eec_firmware3.2.7 or later
- fujitsu m10-1_firmwarexcp2361, xcp3070 or later
- fujitsu m10-4_firmwarexcp2361, xcp3070 or later
- fujitsu m10-4s_firmwarexcp2361, xcp3070 or later
- fujitsu m12-1_firmwarexcp2361, xcp3070 or later
- fujitsu m12-2_firmwarexcp2361, xcp3070 or later
- fujitsu m12-2s_firmwarexcp2361, xcp3070 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openbsd openssh | v ≤ 7.9 | — |
| winscp winscp | v ≤ 5.13 | — |
| canonical ubuntu_linux | 14.04, 16.04, 18.04, 18.10 | — |
| debian debian_linux | 8.0, 9.0 | — |
| netapp element_software | No range specified | — |
| netapp ontap_select_deploy | No range specified | — |
| netapp storage_automation_store | No range specified | — |
| fedoraproject fedora | 30 | — |
| redhat enterprise_linux | 8.0 | — |
| redhat enterprise_linux_eus | 8.1, 8.2, 8.4, 8.6 | — |
| redhat enterprise_linux_server_aus | 8.2, 8.4, 8.6 | — |
| redhat enterprise_linux_server_tus | 8.2, 8.4, 8.6 | — |
| siemens scalance_x204rna_firmware | v < 3.2.7 | 3.2.7 |
| siemens scalance_x204rna_eec_firmware | v < 3.2.7 | 3.2.7 |
| fujitsu m10-1_firmware | v < xcp2361, v < xcp3070 | xcp2361, xcp3070 |
| fujitsu m10-4_firmware | v < xcp2361, v < xcp3070 | xcp2361, xcp3070 |
| fujitsu m10-4s_firmware | v < xcp2361, v < xcp3070 | xcp2361, xcp3070 |
| fujitsu m12-1_firmware | v < xcp2361, v < xcp3070 | xcp2361, xcp3070 |
| fujitsu m12-2_firmware | v < xcp2361, v < xcp3070 | xcp2361, xcp3070 |
| fujitsu m12-2s_firmware | v < xcp2361, v < xcp3070 | xcp2361, xcp3070 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.